<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br></div><div><br>On Jan 9, 2013, at 9:13, Matthias BUSSONNIER &lt;<a href="mailto:bussonniermatthias@gmail.com">bussonniermatthias@gmail.com</a>&gt; wrote:<br><br></div><blockquote type="cite"><div><br><div><div>Le 9 janv. 2013 à 12:57, lecast a écrit :</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">I had a look at jsplugins and indeed it makes sense to use that in my context, although I would still keep my class for rendering static things or things that use css for interactivity.<div><br></div><div>However, the way I understand is that js in unwanted in the saved output because it may communicate with the kernel, and that in turn can do whatever. </div></div></blockquote><div><br></div><br><blockquote type="cite"><div dir="ltr"><div>Wouldn't escaping just such calls be an option too?</div></div></blockquote><div><br></div><div>I'm not sure I understand the question here.&nbsp;</div><div>Removing js evaluation and injection of script tag through IPython is not enough as one can actually forge</div><div>a file that have embedded js. So we need to be carefull</div><br><blockquote type="cite"><div dir="ltr">

<div>For the jsplugins to work I think there should be an install function within IPython where you point at some url that hosts the plugin.</div></div></blockquote><blockquote type="cite"><div dir="ltr"><div> And, there should be an easy way to extend plugins from within IPython so that the user doesn't have to have file system access to add a script.</div></div></blockquote><div><br></div><div>Yes, sure. Plugin will probably be mostly js that can be served from urls. So that shouldn't be too hard.&nbsp;</div><div>But I'm not sure user can have IPython access without filesystem access. I don't really see the point of&nbsp;</div><div>an online computing software if you can't store data or save your notebook...&nbsp;</div></div></div></blockquote><div><br></div><div>You forget that notebook / kernel access and *server* filesystem access are not going to be the same thing for long. &nbsp;For multiuser, it is a safe assumption that n-1 users will *not* have access to installing js plugins (not to mention the fact that current design requires nb server restart, which users also do not have permissions to do).</div><br><blockquote type="cite"><div><div><br><blockquote type="cite"><div dir="ltr"><div style="">Also, the base of the code for my papers-style notebooks that extracts footnotes is at&nbsp;<a href="http://nbviewer.ipython.org/4492534/" target="_top" rel="nofollow" link="external">http://nbviewer.ipython.org/4492534/</a></div></div></blockquote><div><br></div><div>Great ! I'll have a look.&nbsp;</div><div>--&nbsp;</div><div>Matthias</div></div></div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>IPython-dev mailing list</span><br><span><a href="mailto:IPython-dev@scipy.org">IPython-dev@scipy.org</a></span><br><span><a href="http://mail.scipy.org/mailman/listinfo/ipython-dev">http://mail.scipy.org/mailman/listinfo/ipython-dev</a></span><br></div></blockquote></body></html>